CVE-2021-24656

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts depending on the settings used, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml...

CVE-2021-24656 Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts depending on the settings used, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml...

SharpML - Machine Learning Network Share Password Hunting Toolkit

SharpML is a proof of concept file share data mining tool using Machine Learning in Python and C. The tool is discussed in more detail on our blog here, but is summarised below also: SharpML is C and Python based tool that performs a number of operations with a view to mining file shares, queryin...

IndexPool.INIT_POOL_SUPPLY is too large, which may cause a significant amount of fund loss to the first liquidity provider

Handle WatchPug Vulnerability details uint256 internal constant BASE = 1018; ... uint256 internal constant INITPOOLSUPPLY = BASE 100; /// @dev Mints LP tokens - should be called via the router after transferring bento tokens. /// The router must ensure that sufficient LP tokens are minted by usin...

Wrong balance to reserve casting in _updateReserves()

Handle 0xsanson Vulnerability details Impact In HybridPool's updateReserves function, the reserves are calculated as: uint256 reserve0, uint256 reserve1 = balance; This is incorrect, since reserves are a bento-share quantity, while balance outputs a bento-amount quantity. This basically inflates...

HybridPool._updateReserves Wrong implementation

Handle WatchPug Vulnerability details HybridPool.updateReserves is supposed to update the reserves to the latest bento share amounts. Instead, it uses underlying token amounts. In the getReserves function, reserves are treated as bento share amounts and get converted to underlying token amounts...

IndexPool.INIT_POOL_SUPPLY is too large, which may cause a significant amount of fund loos to the first liquidity provider

Handle WatchPug Vulnerability details uint256 internal constant BASE = 1018; ... uint256 internal constant INITPOOLSUPPLY = BASE 100; /// @dev Mints LP tokens - should be called via the router after transferring bento tokens. /// The router must ensure that sufficient LP tokens are minted by usin...

openSUSE 15 Security Update : opera (openSUSE-SU-2021:1310-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1310-1 advisory. - Chromium: CVE-2021-30606 Use after free in Blink CVE-2021-30606 - Chromium: CVE-2021-30607 Use after free in Permissions CVE-2021-30607 -...

openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1303-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1303-1 advisory. - Chromium: CVE-2021-30606 Use after free in Blink CVE-2021-30606 - Chromium: CVE-2021-30607 Use after free in Permissions CVE-2021-30607 -...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2021:1303-1 Rating: important References: 1190096 1190476 Cross-References: CVE-2021-30606 CVE-2021-30607 CVE-2021-30608 CVE-2021-30609 CVE-2021-30610 CVE-2021-30611 CVE-2021-30612 CVE-2021-30613 CVE-2021-30614...

openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1300-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1300-1 advisory. - Chromium: CVE-2021-30606 Use after free in Blink CVE-2021-30606 - Chromium: CVE-2021-30607 Use after free in Permissions CVE-2021-30607 -...

Apple macOS Catalina竞争条件问题漏洞

Apple macOS Catalina is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in macOS Catalina, which can be exploited by an attacker to mount a maliciously crafted NFS network share that could lead to arbitrary code execution with system...

PT-2021-8093 · Samba +8 · Samba +8

Name of the Vulnerable Software and Affected Versions: Samba affected versions not specified Description: The issue is related to errors in synchronization when using a shared resource due to incorrect metadata handling. This allows an authenticated attacker with permissions to read or modify sha...

Denial Of Service (DoS)

chromium is vulnerable to denial of service. The vulnerability exists due to a use after free in Web Share in Google Chrome which allows an attacker to potentially exploit heap corruption via a crafted HTML page...

Vault.withdraw sometimes burns too many shares

Handle cmichel Vulnerability details The Vault.withdraw function attempts to withdraw funds from the controller if there are not enough in the vault already. In the case the controller could not withdraw enough, i.e., where diff toWithdraw, the user will receive less output tokens than their fair...

User may receive less than the eligible amount per the shares being withdrawn

Handle 0xRajeev Vulnerability details Impact User may receive less than the eligible amount per the shares being withdrawn. It is not clear under what conditions this happens but needs to be documented and user warned. Proof of Concept Tools Used Manual Analysis Recommended Mitigation Steps...

Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting

The plugin does not escape the Share Title settings before outputting it in the frontend pages or posts depending on the settings used, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the...

Nextcloud: Folder architecture and Filesizes of private file drop shares can be getten

Steps To Reproduce: 1. Create a new Folder "TestABC" 2. Share a password protected link of this folder 3. Create a file "README.md" and a file "README.md" in the Subfolder "Subfolder". == curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345"...

earn results in decreasing share price

Handle jonah1005 Vulnerability details Impact For a dai vault that pairs with NativeStrategyCurve3Crv, every time earn is called, shareholders would lose money. about 2% There're two issues involved. The Vault contract and the controller contract doesn't handle the price difference between the wa...

removeToken would break the vault/protocol.

Handle jonah1005 Vulnerability details removeToken would break the vault. Impact There's no safety check in Manager.sol's removeToken. Manager.solL454-L487 1. The token would be locked in the original vault. Given the current design, the vault would keep a ratio of total amount to save the gas...